NPC Issuance Wiki

NPC Advisory Opinion No. 2022-022 — Disclosure of COVID-19 Swab Test Results in Group Chat

Issued Advisory Opinion

Official opinion tags

Text

19 October 2022

Re: DISCLOSURE OF COVID-19 SWAB TEST RESULTS IN GROUP CHAT

Dear [Redacted],

We respond to your request for clarification on the data privacy implication of a proposed internal practice of disclosing COVID-19 test results in your office’s group chat.

Discussion

We understand that the Davao Center for Health Development (DCHD) wishes to enhance its contact tracing of COVID-19 positive cases within its office. The intended purpose is to improve infection control and minimize the spread of positive cases to ensure unhampered operations.

You further inform that in a survey conducted among DCHD’s employees, a majority voted to have the complete list of COVID-19 positive employees posted in the group chat composed of 250 members, while a minority opposed the measure. The purpose of posting in the group chat is to let everyone be aware if they are possible close contacts and, thus, enable them to take the necessary precautions to avoid infection.

Thus, you seek guidance on the following:

  1. Due to the majority voting in favor of the posting COVID-19 swab test results in the group chat, is DCHD allowed to post the complete list in the group chat despite a minority signifying to the contrary?

  2. Is written consent still necessary for those who agreed to have their names posted in the group chat once they have positive results?

Lawful criteria for processing of COVID-19 test results, provided by law and regulation; limitations on disclosure

Under the Data Privacy Act of 2012 (DPA),1 the processing of personal data shall only be allowed under certain conditions provided in Sections 12 and 13 depending on whether the information involved is classified as personal information or sensitive personal information. In addition, the Section 18 (b) of the Implementing Rules and Regulations (IRR) of the DPA also requires that the processing of personal data shall be allowed subject to adherence to the principles of transparency, legitimate purpose, and proportionality. Transparency requires that the data subjects are informed of the details of the processing of their personal data, such as the nature, purpose and extent of processing as well as their rights as data subjects. The principle of legitimate purpose, on the other hand, states that the processing of personal information shall be compatible with a declared and specified purpose which must not be contrary to law, morals, or public policy. Finally, proportionality calls for the processing of personal information shall be adequate, relevant, suitable, necessary, and not excessive in relation to a declared and specified purpose.

In the case of COVID-19 contact tracing, we stated in NPC Advisory Opinion No. 2020-0222 that the processing of any personal data, including the test results, is based on law and regulation, viz.:

Accordingly, contact tracing would inevitably involve the processing of personal and sensitive personal information (collectively, personal data) of COVID-19 suspected, probable, and confirmed cases by the DOH and other government agencies engaged in the COVID-19 response.

Such processing for contact tracing is expected to be in accordance with existing laws and regulations on the matter, i.e., Republic Act No. 11332 or the Mandatory Reporting of Notifiable Diseases and Health Events of Public Health Concern Act, the DPA, as well as applicable issuances of the DOH and the NPC.

The DOH Updated Guidelines on Contact Tracing provides for the specific guidelines for the identification of contacts of suspect cases, case investigation and contact tracing for probable and confirmed cases, contact tracing in areas with community transmission, among others. These guidelines also provide for the use of standard forms, i.e., Case Investigation Form, Travel History Form, Close Contact Line List Form, Profile of the COVID-19 Close Contacts, etc.

All these measures ensure that only the necessary personal data are collected in a standard and appropriate manner and disclosed only to the proper authorities.

In the same Advisory Opinion, we further stated that the disclosure of personal data related to COVID-19 shall be made pursuant to Annex A of the DOH Updated Guidelines on Contact Tracing, thus:

  1. Disclosure of Patient Identifiers or Patient Data shall be limited to authorized entities, officers, personnel and concerned individuals only. The said disclosure is allowed if the same will serve a public purpose or function during the COVID-19 pandemic.

Disclosure to the public, the media, or any other public-facing platforms without the written consent of the patient or his/her authorized representative or next of kin, shall be strictly prohibited.

The above policy is further reinforced in the DOH-NPC Joint Memorandum Circular on the Privacy Guidelines on the Processing and Disclosure of COVID-19 Related Data for Disease Surveillance and Response, which contains a similar provision under Section VI (D) (2) thereof on the Specific Guidelines on Use and Disclosure of Health Information.

We also stated in NPC Circular No. 2021-02 that the disclosure of personal data in cases of contact tracing “shall be limited to public health authorities, such as the DOH and its authorized partner agencies, LGUs, or other lawfully authorized entities, officers, or personnel, and must only be for the purpose of responding to the public health emergency.”3

Thus, we do not suggest posting in a group chat the names of employees who are COVID-19 positive. Through Department Memorandum No. 2020-0189, the Department of Health (DOH) already laid down the procedure which a Personal Information Controller (PIC), such as your office, must observe in relation to contact tracing.4 As such, we recommend that the guidelines be strictly observed since it provides the lawful basis which justifies the processing of personal data of employees under the circumstances.

Consent not the appropriate basis for disclosure of COVID-19 swab test results

Under the DPA, consent of the data subject that is freely given, specific, and informed, is recognized as one of the lawful criteria for processing.5 In the present case, however, the parties do not stand on equal footing. In the field of data protection and privacy, it has been recognized that there is a clear imbalance of power between the employer and the employee because by the very nature of the relationship, employees may not have genuine free choice and may not subsequently be able to withdraw their consent without adverse consequences.6 As such, consent is not the most appropriate basis for processing since it can be tricky to ascertain if the employees concerned freely gave their consent.

Instead, the appropriate lawful basis for processing relative to contact tracing purposes is provided and limited by law and regulation, that is, DOH Department Memorandum No. 2020-0189. Given this, it would be inconsistent with the basis for processing to ask employees to consent to such additional processing since it already goes beyond the prescribed procedure under the regulation. Mere participation in the survey in the group chat cannot be recognized as a positive indication of valid consent since the elements of consent under the DPA are not present. Moreover, asking the employees’ consent for processing in addition to what is provided by the law and regulation would be unjust and improper as the data subject may not be able to distinguish the basis for which their personal data is being processed. In

present situation, the employees may feel the need to give their consent for all things related to contact tracing.

Proper procedures already exist to address the demands of the COVID-19 public health emergency while ensuring the protection of the individual’s data privacy. As the PIC and employer, DCHD should adhere with the requirements of the law as well as implement strategies that are least intrusive to the rights and freedoms of its employees. Even though the proposed disclosure in the group chat is made with good intentions, this strategy may run afoul with the employee’s data privacy.

Please be advised that this Advisory Opinion was rendered based solely on the information you have provided. Any extraneous fact that may be subsequently furnished us may affect our present position. Please note further that our Advisory Opinion is not intended to adjudicate the rights and obligations of the parties involved.

Please be guided accordingly.

Very truly yours,

(Sgd.) FRANKLIN ANTHONY M. TABAQUIN IV Director IV, Privacy Policy Office

Footnotes

  1. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173 (2012). ↩

  2. See National Privacy Commission, NPC Advisory Opinion No. 2020-022 (8 June 2022). ↩

  3. See National Privacy Commission, Guidelines on the Processing of Personal Data During Public Health Emergencies for Public Health Measures, NPC Circular No. 2021-02 [NPC Circular 21-02] (08 November 2021). ↩

  4. Department of Health, Update Guidelines on Contact Tracing of Close Contacts of Confirmed Coronavirus Disease (COVID19) Cases, Department Memorandum No. 2020-0189 (17 April 2020). ↩

  5. Data Privacy Act of 2012, § 3 (b). ↩

  6. See Article 29 Working Party, Opinion 8/2001 on the processing at work (13 September 2001) available at https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2001/wp48_en.pdf (last accessed 31 March 2022). ↩

Backlinks

  • No backlinks found